Apple has fixed a security flaw in its iOS 26, iPadOS 26 and macOS 26 operating systems that the company said “may have been exploited” by hackers. The tech giant said the now-fixed bug could be used to launch “a highly sophisticated attack against specific targeted individuals on versions of iOS prior to iOS 27.”
According to an announcement on Apple Security PagesThe bug was found in the main graphics engine that powers the user interface and visuals on iPhones, iPads and Macs.
Meta’s product security team was credited with this discovery.
Details of the bug, officially classified as CVE-2026-86950, have not been released, but a device’s graphics engine typically has broad access to the rest of the device’s operating system. A successful exploit could potentially allow a hacker to steal a wide range of personal data from an affected device.
When contacted by TechCrunch, spokespersons for Apple and Meta did not provide comment on how the bug was discovered, or how many people had their devices hacked due to this vulnerability, if any. It’s also unclear who might exploit the bug, such as government spyware creators or cybercriminals.
Although the bug affects Apple’s previous generation of operating systems, it remains widely used. Nearly four in five iPhone owners are still using iOS 26, according to the company’s report. statistics. Devices running the latest version, iOS 27, iPadOS 27 and macOS 27, released earlier this month, also received a software update on Tuesday but are not affected by the attacked bug.
A separate zero-click bug now fixed
News of the security patch comes shortly after Apple fixed another critical security bug, known as CVE-2026-86869, which could have allowed hackers to silently steal data from affected iPhones, iPads or Macs.
Belgian cybersecurity research company ironPeak has published a detailed article last week explaining that the bug was a “zero click” vulnerability that could be triggered invisibly via a maliciously crafted iMessage, without the user’s knowledge. Such bugs require no interaction from the victim, such as clicking on a link, and are highly sought after by monitoring service providers and spyware makers.
According to ironPeak’s post, the bug is able to bypass BlastDoor, a security feature implemented by Apple to prevent malicious code, like spyware, from escaping the iMessage sandbox and hijacking the user’s device.
Apple fixed the bug in September with the release of iOS 27, iPadOS 27 and macOS 27, and credited Niels Hofmans of ironPeak with the discovery, alongside Meta security researchers who confirmed their findings in a post on.
It is not yet known whether this bug was used in cyberattacks before being fixed.
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.
